1. Field of the Invention
This invention relates to an encryption system and method, and in particular to a system and method for recovering a session key so as to provide access by an authorized third party to data encrypted by the session key, the system and method being capable of use with a variety of strong encryption software, thereby enabling the strong encryption software to comply with U.S. encryption technology export restrictions.
The invention also relates to procedures for ensuring that only certified parties will have access to the recreated session keys and decrypted data, thereby protecting the privacy of all non-suspect communications utilizing the subject software, as well as of the information contained in the suspect communications.
2. Description of Related Art
The principal problem addressed by the invention is the problem of providing strong encryption software to protect sensitive communications while affording legal authorities access to the communications in order to comply with U.S. Government regulations concerning the export of encryption software.
Export of encryption products from the United States of America is controlled by the U.S. Government's Bureau of Export Administration (BXA) in the Commerce Department. In December of 1996, the rules for export of encryption products were modified so that it became possible, in some circumstances, for U.S. manufacturers of encryption products to ship software/hardware components that utilize "strong" encryption algorithms, i.e., symmetric algorithms with key sizes larger than 56 bits, so long as recovery of the encrypted data, or the keys protecting the data, were available to law enforcement agents to satisfy investigatory requirements.
The mechanisms anticipated by the government that would satisfy the regulations were generally classified as "Trusted Third Party" services, wherein a separate organization would provide escrow, or recovery services, to customers wishing to employ strong encryption to protect electronic commerce transactions, the customers being required to prepend to the file an encrypted version of the session key so as to enable recovery by a third party in possession of the key necessary to decrypt the encrypted session key. However, the regulations also left open the possibility that an organization could perform its own escrow services, i.e., provide for recovery of session keys by decrypting the "key recovery keys" or law enforcement fields containing the keys, if safeguards concerning certification of the parties involved in the escrow services could be implemented, so as to meet the requirements without potentially exposing data to a third party.
The present invention takes another approach, which permits the organization to manage its own key recovery services, but which is fundamentally different from prior third or first party escrow approaches in that modification of the encryption software to provide for a key recovery key or law enforcement field is not required. Instead of providing for recovery of an encrypted session key through the use of a key recovery or escrow agent with the ability to decrypt the key recovery key, the present invention recreates the original key exchange process with the assistance of the authentication server to recover the session key based on a recording of clear text or non-encrypted data exchanged during the handshaking procedure by which the original session key was generated.
Like the escrow approach, the system and method of the invention can be applied to situations in which a communication contains data encrypted by a session key unique to the communication. The system and method of the invention utilizes the property of certain encryption systems, to which the present invention is applicable, that a recording of the suspect communication, which can be made without the knowledge of the parties to the communication using wiretapping and similar methods, will include all information necessary to generate the session key, including clear text session-specific values in the case of a shared secret key encryption protocol, or the original key exchange ticket in the case of public/private key cryptosystem based key exchange procedures. Where the shared secret key used to generate the session key, or the private key used to decrypt a session key contained in a recorded key exchange or authorization ticket is held in a database protected by an authentication server, access to the shared secret key or private key can easily be provided by a secured communications link to the server.
Significantly, unlike the previously proposed escrow approaches, the present invention also has the advantage that it can be implemented without modifying the underlying encryption software, there being no need to modify the software to generate the key recovery key, law enforcement field of a transmission, or the like, which eliminates the possibility of tampering by the parties to the suspect communication, and enables the method and system of the invention to be adapted for use with a wide variety of existing encryption software, including software already being marketed in the U.S. but not otherwise exportable.
Despite the capability of recovering session keys used in strong encryption systems, the system and method of the invention is capable of being implemented using simple Windows.TM. based software running on a laptop or notebook computer, in conjunction with a smartcard reader or similar device, and can be provided by the vendor to the customer or licensee in the form of a software and hardware "kit," upon BXA approval, which involves certification of the various persons responsible for the key recovery functions, and does not require any modification of the basic encryption system to which access is required, allowing a variety of existing strong encryption software to be approved for export simply by licensing the encryption software with the appropriately adapted "kit" and certifying appropriate personnel of the customer.
As indicated above, the invention is to be distinguished from prior key recovery methods, such as the ones described in copending U.S. Ser. No. 08/892,947, assigned to V-One Corporation, and in U.S. Pat. Nos. 5,557,346 and 5,557,765, assigned to Trusted Information Systems, which involve encrypting the session key by means of the public key of a public/private key cryptosystem, the private key to which is held by the key recovery agent in order to permit the session key to be recovered, and prepending the resulting "key recovery key" or "law enforcement access field" to the encrypted file or transmission.
Because, unlike third party escrow-based session key recover methods, the present invention requires that the key recovery agent request the authentication server to again generate the session key, the present invention also relates to ensuring that the key recovery agent is properly certified and authenticated, and that all communications involving retrieval of session keys, or information protected thereby, are properly secured.
It will be appreciated that the invention can be used in connection with any system or method in which the session key is generated by an exchange of clear text data between clients, and in which the secret or private keys used to generate the session key based on the clear text data are stored at a location and in a manner accessible to the customer. An example of such a system is the SmartGate.TM. system offered by V-One Corporation, and described in U.S. Pat. No. 5,602,918, herein incorporated by reference. Other systems to which the invention is applicable include SSL ticket-based key exchange procedures and procedures based on the Diffie-Hellman method.
For example, in the SmartGate.TM. system, which is described herein in order to illustrate one particular application of the invention, and is not intended to be limiting, the client initiating the communication sends its user ID via a client node to an authentication server, which retrieves a shared secret key associated with the user ID and responds by sending a clear text first random number to the client node. The client node encrypts, using a token which may be secured by a smartcard or provided in software on the client's computer, the first random number and in turn generates a second random number, sending the encrypted first random number back to the authentication server for authentication by the authentication server of the client node and the clear text second random number back to the authentication server so that the authentication server can encrypt it using its shared secret key and send it back to the client node for authentication of the authentication server by the client node. The session key in this system is generated by symmetrically encrypting, using the shared secret keys, combinations of the clear text random numbers generated by the parties using the shared secret key which each party has verified to be possessed by the other party to the communication. In order to recover the session keys thus generated, it is simply necessary to have the authentication server retrieve its shared secret key and apply it to the recorded clear text random numbers.
On the other hand, in an alternative method of using session keys to protect communications, the session key is generated by one of the parties based on exchanged clear text data during the handshaking procedure, and transmitted to the other party by encrypting it with the public key of the other party to form an authorization ticket, which is then decrypted by the other party using the private key of the other party. In that case, in order to recover the session key using the principles of the invention, the key recovery agent supplies the original ticket, which has been recorded, to the party having the private key necessary to decrypt the ticket, and has the party decrypt it to obtain the session key.
In either case, the session key is recovered based on a recording of the handshaking procedure used to generate the session key, and application of a recreation of the procedure to the recording. For purposes of the present invention, the important point of the mutual authentication and session key generating process used by the SmartGate.TM. example is that there are three elements necessary to generate the session key, namely the two random numbers which are transmitted in clear text form during the session key generating handshaking procedure, and a shared secret key which is not transmitted, but which are present in a database accessible by the authentication server based on the user identification provided at the initiation of the handshaking procedure. On the other hand, in the case of A Diffie-Hellman, SSL, or other public/private cryptosystem-based key exchange procedure, the principles of the invention may be applied to a recording of the original ticket containing the session key and cooperation of the authentication server of the ticket to decrypt the recorded ticket using its private key and recover the session key.
The main practical difficulties in implementing this concept are the need for limiting access to key recovery communications containing sensitive information to parties certified for involvement in the key recovery process, establishing an audit trail, and protecting the communications between the certified parties. These problems are also addressed by the present invention, through the use of individual password-accessed hardware tokens which store strong encryption keys for the individual certified parties, and which are used to protect network communications and authenticate the parties, with initial entry being provided by a password-accessed hardware token common to all "customer" personnel involved in key recovery.